CVE-2023-1668

Katalog CVE

CVSS 8.2 · High EPSS 1,2%

Kerentanan Always-Incorrect Control Flow Implementation pada cloudbase open vswitch, debian linux +4 lainnya. Skor CVSS 3.1 8.2 (High) menurut NVD.

Deskripsi (NVD)

A flaw was found in openvswitch (OVS). When processing an IP packet with protocol 0, OVS will install the datapath flow without the action modifying the IP header. This issue results (for both kernel and userspace datapath) in installing a datapath flow matching all IP protocols (nw_proto is wildcarded) for this flow, but with an incorrect action, possibly causing incorrect handling of other IP packets with a != 0 IP protocol that matches this dp flow.

Rincian

Terbit di NVD

10 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.2 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-670: Always-Incorrect Control Flow Implementation

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 67,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.openwall.com/lists/oss-security/2023/04/06/1 mailing list · mitigasi · patch
• https://bugzilla.redhat.com/show_bug.cgi?id=2137666 issue tracking · advisory pihak ketiga
• https://www.debian.org/security/2023/dsa-5387 advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/05/msg00000.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/V2GUNS3WSJG4T...
• https://security.gentoo.org/glsa/202311-16